Also known as: fuzz testing · coverage-guided fuzzing · AFL
Fuzzing is an automated testing technique that feeds a program large volumes of malformed, unexpected, or random input to discover crashes, hangs, and memory-safety violations.
Modern coverage-guided fuzzers instrument the target to observe which code paths each input reaches, then mutate inputs to maximise new coverage. This turns fuzzing from blind random input into a directed search, dramatically improving effectiveness.
Fuzzing has proven exceptionally productive against parsers, decoders, and protocol implementations — anything consuming untrusted structured input — and is responsible for a substantial share of memory-safety vulnerabilities found in widely-used libraries.
Static Analysis
Static analysis examines source code without executing it, detecting bugs, security vulnerabilities, and style violations by reasoning about possible program behaviours.
Memory Safety
Memory safety is the property of a program being unable to access memory outside the bounds of what it legitimately owns, preventing entire vulnerability classes such as buffer overflows, use-after-free, and data races.
Buffer Overflow
A buffer overflow is a memory-safety vulnerability in which a program writes more data into a fixed-size memory buffer than it can hold, corrupting adjacent memory and potentially allowing an attacker to alter program execution.
Use-After-Free
A use-after-free is a memory-safety vulnerability in which a program continues to use a pointer to memory that has already been released, allowing an attacker who can control what occupies that memory to influence program behaviour.
CI/CD
CI/CD (continuous integration and continuous delivery) is the practice of automatically building, testing, and deploying code changes, so that every commit is verified and releases become routine rather than exceptional events.